feat: add supabase deployer

playbooks/deploy_supabase.yml

@@ -0,0 +1,44 @@
+---
+# Deploy Supabase on OpenShift (SNO) via the supabase-community Helm chart.
+#
+# Chart: https://github.com/supabase-community/supabase-kubernetes
+#
+# Prerequisites:
+#   - cert-manager installed (deploy_openshift.yml --tags sno_deploy_certmanager)
+#   - NFS StorageClass available (deploy_openshift.yml --tags sno_deploy_nfs)
+#   - supabase-deployer ServiceAccount provisioned and token saved to 1Password:
+#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+#   - vault_supabase_deployer_token set in host_vars (see hashivault_secrets.yml)
+#
+# All Supabase secrets (JWT, DB password, etc.) are auto-generated on first run
+# and stored in Vault at supabase_vault_path. No manual secret setup required.
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout
+#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_chart_version=0.0.9
+#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_db_storage_size=20Gi
+
+- name: Deploy Supabase on OpenShift
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+
+  environment:
+    K8S_AUTH_HOST: "{{ supabase_k8s_api_url }}"
+    K8S_AUTH_API_KEY: "{{ vault_supabase_deployer_token }}"
+    K8S_AUTH_VERIFY_SSL: "false"
+
+  pre_tasks:
+    - name: Verify supabase-deployer token is available
+      ansible.builtin.assert:
+        that:
+          - vault_supabase_deployer_token is defined
+          - vault_supabase_deployer_token | length > 0
+        fail_msg: >-
+          vault_supabase_deployer_token is not set.
+          Provision the ServiceAccount with:
+            ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+          Then save the displayed token to 1Password and reference it as vault_supabase_deployer_token.
+
+  roles:
+    - role: supabase